1. Field of the Invention
The present invention relates in general to the field of information handling system security, and more particularly to information handling system secret protection across multiple memory devices.
2. Description of the Related Art
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
Information handling systems often store sensitive information, sometimes using complex encryption methods. One weakness with the use of encryption is that exposure of an encryption key allows an unauthorized user to access encrypted information. Another weakness is that information typically is decrypted when used and thus accessible to unauthorized users when stored in memory in a decrypted form. Generally, security measures at information handling systems, such as anti-malware and firewall applications, will protect against attacks against an information handling system that is running and executing security measures. When the information handling systems are powered down, information stored in persistent memory with an adequately-secure password will withstand substantial efforts to break the password. Thus, even if an information handling system is physically stolen, encrypted information stored in persistent memory is relatively safe from unauthorized access.
Certain attack vectors allow retrieval of secrets from information handling system memory by interfacing with random access memory (RAM) before power is removed from the RAM. Often RAM stores sensitive information, such as passwords, account numbers, and personal information, in unencrypted form for use by the processor and operating system while the system is running. RAM is generally considered non-persistent memory in that information stored in RAM is lost when power is removed from the information handling system. In fact, RAM persists information for brief periods of time without power and maintains information for longer periods of time by applying power to periodically refresh the memory, the method most commonly used to put a consumer computer “to sleep.” The length of time that RAM persists information without power depends upon a number of factors including the amount of power applied at each refresh and the temperature of the RAM.
If an unauthorized person obtains physical access to an information handling system while RAM has power, the unauthorized person can retrieve data from the RAM by moving the RAM to a different information handling system for access. For example, if an end user leaves an information handling in the S3 sleep mode, commonly known to a user as putting a computer “to sleep,” then the RAM remains powered on for a quick system restart. An unauthorized person who obtains physical control of the information handling system in the S3 sleep mode opens the housing, removes the RAM and places the RAM in another information handling system while information stored in the RAM persists. Once the RAM has power in the new information handling system, the contents stored in the S3 mode can be retrieved at the attacker's leisure.
One technique for prolonging the time that RAM persists information is to place an information handling system in a cold space, such as a freezer, while the information handling system is in S3 power saving mode. The reduced temperature will often prolong the retention of information in RAM for greater than a minute. Other malicious or data compromising attacks are known and described in Wikipedia and other sources. Various countermeasures are also available, such as encryption of data in RAM. However, if a user does not properly protect a system with operating system and/or preboot passwords, a successful attack can allow an attacker to read all contents of memory, including SMRAM/SMM protected memory that is normally unreadable during runtime (aka, “not asleep”) when the system is properly initialized. Since information extracted from RAM can include passwords, cryptographic keys and sensitive personal information, a successful attack can lead to extended vulnerabilities that include hard drive and network hacks.